"24,000 South Korean Servers Running Vulnerable PHP Versions"

Following the discovery of a critical PHP vulnerability that allows servers to be hijacked without login credentials, an analysis has shown that there are 24,591 servers in South Korea running older versions that no longer receive official patches.

In an analysis released on October 21 (local time), French cybersecurity firm CybelAngel stated, based on data from the security search engine Shodan as of October 20, that approximately 2.24 million servers worldwide exposed PHP.

Among the roughly 1.5 million servers whose versions could be identified, 883,717 servers (59%) were running older versions for which no patches are available.

The company explained that the actual scale of exposure could be even larger, as about 740,000 servers had hidden their versions.

According to the country-by-country analysis, internet-connected servers in South Korea running PHP versions 8.1 or lower—for which update support has ended—totaled 24,591, accounting for 82% of the domestic PHP servers whose versions were identified.

Among the top 10 countries analyzed, this proportion of outdated versions was the second highest, following Algeria (100%).

China followed at 75%, Hong Kong at 70%, and Japan at 61%.

No domestic damage has been reported to date.

In terms of the total number of vulnerable servers, South Korea ranked 8th, following the United States (228,770), China (67,306), and Japan (55,460).

By hosting provider, PHP servers were heavily concentrated in a few companies such as Amazon (293,480), Hostinger (142,401), and Alibaba Cloud (81,078), leading CybelAngel to point out that patches at the provider level are crucial.

However, these figures represent the number of servers and differ from the number of websites.

Servers with hidden versions were excluded from the tally, and because these are CybelAngel's internal estimates, the numbers may differ from statistics compiled by other organizations.

(Photo: Captured from CybelAngel blog, Yonhap News)
※ Please note: This article was translated by AI and may contain errors.